linux-kernel - Re: [PATCH v14 00/19] x86: Trenchboot secure dynamic launch Linux kernel support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f736128a-04d6-4f81-8aba-67b857e99e7d@intel.com>
Date: Tue, 22 Apr 2025 12:16:57 -0700
From: Dave Hansen <dave.hansen@...el.com>
To: Andrew Cooper <andrew.cooper3@...rix.com>,
 Ross Philipson <ross.philipson@...cle.com>, linux-kernel@...r.kernel.org,
 x86@...nel.org, linux-integrity@...r.kernel.org, linux-doc@...r.kernel.org,
 linux-crypto@...r.kernel.org, kexec@...ts.infradead.org,
 linux-efi@...r.kernel.org, iommu@...ts.linux.dev
Cc: dpsmith@...rtussolutions.com, tglx@...utronix.de, mingo@...hat.com,
 bp@...en8.de, hpa@...or.com, dave.hansen@...ux.intel.com, ardb@...nel.org,
 mjg59@...f.ucam.org, James.Bottomley@...senpartnership.com,
 peterhuewe@....de, jarkko@...nel.org, jgg@...pe.ca, luto@...capital.net,
 nivedita@...m.mit.edu, herbert@...dor.apana.org.au, davem@...emloft.net,
 corbet@....net, ebiederm@...ssion.com, dwmw2@...radead.org,
 baolu.lu@...ux.intel.com, kanth.ghatraju@...cle.com,
 trenchboot-devel@...glegroups.com
Subject: Re: [PATCH v14 00/19] x86: Trenchboot secure dynamic launch Linux
 kernel support

On 4/22/25 11:17, Andrew Cooper wrote:
> On 21/04/2025 9:52 pm, Dave Hansen wrote:
>> Purely from the amount of interest and review tags and the whole "v14"
>> thing, it doesn't look like this is very important to anyone. Not to be
>> to flippant about it, but if nobody else cares, why should I (or the
>> other x86 maintainers)?
> There are several downstreams already using this as a part of their
> overall system security, one example being
> https://www.qubes-os.org/doc/anti-evil-maid/

OK, but what problems are they solving by using this as opposed to
existing trusted boot?

While I don't doubt that folks _can_ install and use Xen on their
laptop, it's unclear to me how pervasive this is. Is this just folks
tinkering around or is this something that has large deployments where
folks really *CARE* about it?